1

试图让馆长清理我命名为“syslog”的索引

我有这个动作yml：

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: syslog
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: hours
      unit_count: 1
      exclude:

我尝试了“小时”和“天”，但我一直从策展人那里收到这条消息：

 Skipping action "delete_indices" due to empty list: <class 'curator.exceptions.NoIndices'>
4

1 回答 1

4

您告诉 Curator 您希望它识别具有前缀值的syslog索引，并且索引名称中还有一个 Year.Month.Day 时间字符串。这将匹配，例如，如果索引名称是syslog-2017.03.14. 但是如果索引的名称是 only syslog，这个过滤器集将不匹配。

也许您想捕捉相对于索引创建时间的索引年龄。在这种情况下，你会设置

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than hour
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: regex
      value: '^syslog$'
    - filtertype: age
      source: creation_date
      direction: older
      unit: hours
      unit_count: 1

这将只匹配一个至少比执行时间早一小时syslog的索引。creation_date

于 2017-03-17T02:27:59.050 回答